Can a New Jersey employer ask for your social media password? N.J.S.A. 34:6B-5 to 34:6B-10 explained

New Jersey protects the social media accounts of employees and job applicants in P.L.2013, chapter 155, codified at N.J.S.A. 34:6B-5 to 34:6B-10 (P.L.2013, c.155, as enacted). The Act was approved on 28 August 2013 and took effect on the first day of the fourth month after enactment, which by our count is 1 December 2013 (Section 7).

The short answer: a New Jersey employer may not require or request a current or prospective employee to give a user name or password, or in any way give the employer access to a personal social networking account. It may not retaliate or discriminate against someone who refuses, and it may not make them waive these rights to get a job. Violations carry civil penalties of up to $1,000 for a first violation and $2,500 for each later one, collected by the Commissioner of Labor and Workforce Development. Work accounts, specific-information investigations and public information are exempt.

This page is based on the Act as enacted, published by the New Jersey Legislature. Check the current statutes for any later amendments.

Who is covered

• Employer: an employer or its agent, representative or designee. It does not include the Department of Corrections, the State Parole Board, county corrections departments or any State or local law enforcement agency (34:6B-5).
• Employees and applicants: both current and prospective employees are protected (34:6B-6).
• Personal account: an account, service or profile on a social networking website used by the employee or applicant exclusively for personal communications unrelated to any business purpose of the employer. Accounts created, maintained, used or accessed for the employer's business or for business-related communications are not covered (34:6B-5).
• Social networking website: an internet-based service that lets people build a public or semi-public profile, list the users they share a connection with, and view their own and others' connections (34:6B-5). Our reading, not a court ruling, is that this is narrower than the "personal internet account" wording of states such as Tennessee, so a personal e-mail account may fall outside it.

What employers may not do

• Ask for the password or access: require or request a current or prospective employee to provide or disclose any user name or password, or in any way provide the employer access to, a personal account through an electronic communications device (34:6B-6).
• Make you waive the law: require an individual to waive or limit any protection under the Act as a condition of applying for or receiving a job offer. Any agreement to waive these rights is void and unenforceable (34:6B-7).
• Retaliate: retaliate or discriminate against someone because they refused to give a user name, password or access, reported an alleged violation to the Commissioner of Labor and Workforce Development, took part in an investigation or proceeding about a violation, or otherwise opposed a violation (34:6B-8).

The Act does not separately mention adding the employer as a contact, logging in in front of the employer or changing privacy settings. Our reading, not a court ruling, is that a request to "in any way provide the employer access to" a personal account is broad enough to reach a request to log in so the employer can look, or to accept it as a contact on a private profile.

What employers may still do

The Act does not stop an employer from (34:6B-10):

• Legal duties: complying with State or federal statutes, rules or regulations, case law or rules of self-regulatory organizations;
• Work devices and accounts: setting and enforcing a policy on the use of an employer-issued electronic communications device, or of accounts or services the employer provides or that the employee uses for business purposes;
• Investigations: investigating to ensure compliance with laws, regulatory requirements or bans on work-related employee misconduct, based on specific information about activity on an employee's personal account, or investigating an employee's actions based on specific information about an unauthorized transfer of the employer's proprietary information, confidential information or financial data to a personal account;
• Public information: viewing, accessing or using information about a current or prospective employee that can be obtained in the public domain.

Unlike some states, the Act does not say what an employer may require of the worker during such an investigation.

Enforcement

An employer that violates any provision of the Act faces a civil penalty of up to $1,000 for the first violation and up to $2,500 for each subsequent violation, collectible by the Commissioner of Labor and Workforce Development in a summary proceeding under the Penalty Enforcement Law of 1999 (34:6B-9). The Act as enacted does not itself give workers a right to sue.

What this means in practice

• Employers: do not ask staff or candidates for social media logins or for any way into their personal profiles, and do not put a waiver of these rights in an application or offer. Keep login rules to devices and accounts you issue or that are used for your business.
• Workers and applicants: you can refuse, and the employer may not retaliate. You can report a violation to the Commissioner of Labor and Workforce Development, and the employer may not punish you for that either. Public information can still be seen.

Compare the Tennessee social media password law and the other states in social media password laws in the US. Connecticut also bars requesting a login, and expressly bars requesting or requiring a worker to log in in front of the employer, see the Connecticut social media password law.

This page covers New Jersey and is general information based on P.L.2013, chapter 155 as published by the New Jersey Legislature when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.